actually, my full requirement is only one rule: department manager can view all managed department's member include deeper-level sub-departments